Would this DoS attack be effective:

  1. Attacker determines target (

  2. Attacker sends ack packets to a buch of web servers with a src addr of

  3. Servers reply to with syn packets

Is the target effectively dosed or have we added an arbitrary steps to the equation?


Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001.


Cloudflare blog entry about DNS Amplification DDoS, and follow-up with details about how Cloudflare deals with such things..

  • 5
    DNS amplification attacks are a special kind, and worth covering in more detail. Essentially they work by sending a request whose response is known to be large, using a spoofed source IP. If the response is 800 bytes and your request is 100 bytes, you have an amplification factor of 8. This means that you can hit your target with 8 times the bandwidth you actually have access to. – Polynomial Oct 26 '12 at 6:10
  • Could this be used to even greater effect with multicast? – November Oct 26 '12 at 19:42
  • 1
    @November No because multicast traffic requires a subscription by the router. Unlike unicast traffic, a stream can simply be turned off. – Jeff Ferland Oct 30 '12 at 20:20
  • @November - the clearest explanation of multicast I found: www4.ncsu.edu/~rhee/clas/csc495j/ip-multicast-part1.pdf As Jeff Ferland notes, the routers have to be in on the multicast, so if you're not on the same subnet, you can't use multicast to amplify even further. – Bruce Ediger Oct 30 '12 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.